supervised theses

master's theses

1. Design and development of a new tool for detecting Tactics, Techniques and Procedures (TTPs) in threat intelligence reports
   Miguel Pinto Morales · co-supervised with Laura María Cornejo Bueno
   Master's Degree in Cybersecurity, 2026 (in Spanish: Estudio y desarrollo de una nueva herramienta para la detección de Técnicas, Tácticas y Procedimientos (TTPs) desde informes de inteligencia de amenazas)

   TTPAutoGraph, an open-source Python tool that extracts MITRE ATT&CK TTPs (with TTPXHunter, based on SecureBERT) and indicators of compromise from PDF threat reports, and displays them as interactive graphs to compare reports and profile APT groups. It is validated against the analyst-annotated CTI-HAL dataset.

   cyber threat intelligence · TTPs · MITRE ATT&CK · SecureBERT · APT groups · Full text in e-Buah

2. Automated extraction of Tactics, Techniques and Procedures (TTPs) from threat reports to build a unified dataset for attribution
   David Duque Gómez · co-supervised with Laura María Cornejo Bueno
   Master's Degree in Cybersecurity, 2026 (in Spanish: Extracción de Técnicas, Tácticas y Procedimientos (TTPs) desde informes sobre amenazas mediante herramientas automáticas para la generación de un dataset unificado orientado a la atribución)

   A reproducible pipeline that processes PDF CTI reports and extracts TTPs and indicators of compromise with TTPXHunter and with a large language model (Claude), adding the reports' visual content through a multimodal model. The result is a unified dataset of 1,673 reports, intended as a basis for attributing attacks to APT groups.

   cyber threat intelligence · TTPs · attribution · language models · dataset · Full text in e-Buah

3. Evaluation of public cyber threat intelligence datasets
   Eva María Bernat Fernández
   Master's Degree in Cybersecurity, 2026 (in Spanish: Evaluación de datasets públicos de inteligencia de ciberamenazas)

   A framework for measuring the quality of openly shared cyber threat intelligence, applied to almost 20,000 LevelBlue OTX pulses. They are normalized and enriched with MITRE ATT&CK, MISP Galaxy and Malpedia, compared with CIRCL using VirusTotal as ground truth, and used to test adversary attribution with NMF; source quality limits attribution quality.

   cyber threat intelligence · data quality · LevelBlue OTX · attribution · VirusTotal · Full text in e-Buah

4. Analysis of the ransomware ecosystem
   Bianca Natalia Cerutti
   Master's Degree in Cybersecurity, 2026 (in Spanish: Análisis del ecosistema de ransomware)

   A cyber intelligence analysis of how ransomware evolved between 2020 and 2026, covering more than 25,000 attacks, 800 vulnerabilities and 3,000 techniques. It shows the shift to double extortion, fragmentation into short-lived groups under the RaaS model, and the growing role of initial access brokers over vulnerability exploitation.

   ransomware · cyber intelligence · double extortion · RaaS · MITRE ATT&CK · vulnerabilities · Full text in e-Buah